uphold-logiinnn[.]blogspot[.]it

This domain, uphold-logiinnn.blogspot.it, is flagged as an active phishing site targeting Uphold account credentials. Analysis of the page title, 'Uphold Login | Secure Access to Your Uphold Account,' confirms the domain is designed to mimic the legitimate Uphold login portal. The site is hosted on Blogger infrastructure, a common tactic used to evade detection by leveraging trusted platforms. It resolves to IP address 142.250.184.225, which is associated with Google's network, further obscuring its malicious intent behind legitimate hosting services. Infrastructure analysis reveals the use of technologies including Java, Python, OpenGSE, and HTTP/3, which are consistent with modern web applications but provide no inherent indication of legitimacy. The SSL certificate is issued by Google Trust Services, a valid certificate authority, which may deceive users into trusting the site. However, the domain is currently blocked by at least one security vendor, PhishDestroy, and appears on one additional security blocklist. VirusTotal reports that 7 out of 95 security vendors have flagged this domain, indicating a moderate level of detection but not universal consensus. The exact content and functionality of the phishing page remain unconfirmed, as the site has not been directly analyzed for visual or interactive elements. However, the combination of the page title, hosting on a free blogging platform, and detection by multiple security tools strongly suggests an intent to harvest Uphold login credentials. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it. Network security teams are advised to check logs for connections to 142.250.184.225 or the domain itself, particularly from endpoints that may have interacted with financial services. If credentials were entered, immediate password resets and multi-factor authentication reviews are recommended for affected accounts.